{{Expansion|Fill in the unknowns. Mention {{Pkg|dingo}}, maybe below table because it only works with one provider and therefore doesn't really fit into the table.}}

+

{{Expansion|Fill in the unknowns. Add: 1) {{Pkg|dingo}}, maybe below table because it only works with one provider and therefore doesn't really fit into the table; 2) [[Rescached]]; 3) {{Pkg|powerdns-recursor}}.}}

The Glibc resolver provides only the most basic necessities, it does not cache queries nor provides any security features. If you require more functionality, use another resolver.

The Glibc resolver provides only the most basic necessities, it does not cache queries nor provides any security features. If you require more functionality, use another resolver.

Line 97:

Line 97:

* ''resolvconf compatibility'': can acquire name servers and search domains, to use for forwarding requests, from software that sets them using [[resolvconf]].

* ''resolvconf compatibility'': can acquire name servers and search domains, to use for forwarding requests, from software that sets them using [[resolvconf]].

Name Service Switch

The Name Service Switch (NSS) facility is part of the GNU C Library (glibc) and backs the getaddrinfo(3) API, used to resolve domain names. NSS allows system databases to be provided by separate services, whose search order can be configured by the administrator in nsswitch.conf(5). The database responsible for domain name resolution is the hosts database, for which glibc offers the following services:

Glibc resolver

The glibc resolver reads /etc/resolv.conf for every resolution to determine the nameservers and options to use.

resolv.conf(5) lists nameservers together with some configuration options.
Nameservers listed first are tried first, up to three nameservers may be listed. Lines starting with a number sign (#) are ignored.

Note: The glibc resolver does not cache queries. To improve query lookup time you can set up a caching resolver. See #Resolvers for more information.

Overwriting of /etc/resolv.conf

Network managers tend to overwrite /etc/resolv.conf, for specifics see the corresponding section:

To prevent programs from overwriting /etc/resolv.conf you can also write-protect it by setting the immutable file attribute:

# chattr +i /etc/resolv.conf

Tip: If you want multiple processes to write to /etc/resolv.conf, you can use resolvconf.

Limit lookup time

If you are confronted with a very long hostname lookup (may it be in pacman or while browsing), it often helps to define a small timeout after which an alternative nameserver is used. To do so, put the following in /etc/resolv.conf.

options timeout:1

Hostname lookup delayed with IPv6

If you experience a 5 second delay when resolving hostnames it might be due to a DNS-server/Firewall misbehaving and only giving one reply to a parallel A and AAAA request.[1] You can fix that by setting the following option in /etc/resolv.conf:

options single-request

Local domain names

If you want to be able to use the hostname of local machine names without the fully qualified domain names, then add a line to /etc/resolv.conf with the local domain such as:

domain example.com

That way you can refer to local hosts such as mainmachine1.example.com as simply mainmachine1 when using the ssh command, but the drill command still requires the fully qualified domain names in order to perform lookups.

From resolved.conf(5): Note as the resolver is not capable of authenticating the server, it is vulnerable for "man-in-the-middle" attacks.[2] Also, the only supported mode is "opportunistic", which makes DNS-over-TLS vulnerable to "downgrade" attacks.

Privacy

Most DNS servers keep a log of IP addresses and sites visited on a more or less temporary basis. The data collected can be used to perform various statistical studies. Personally-identifying information have value and can also be rented or sold to third parties. Alternative DNS services provides a list of popular services, check their privacy policy for information about how user data is handled.

Lookup utilities

To query specific DNS servers and DNS/DNSSEC records you can use dedicated DNS lookup utilities. These tools implement DNS themselves and do not use NSS.

ldns provides drill(1), which is a tool designed to retrieve information out of the DNS.

For example, to query a specific nameserver with drill for the TXT records of a domain:

$ drill @nameserver TXT domain

If you do not specify a DNS server drill uses the nameservers defined in /etc/resolv.conf.